Scrape HackerOne hacktivity and disclosed reports to detect duplicate patterns before submitting - prevents wasted submissions and reputation damage
From greyhatccnpx claudepluginhub overtimepog/greyhatcc --plugin greyhatccThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
/greyhatcc:hacktivity <program_name> [finding_description]
{{ARGUMENTS}} is parsed automatically:
security) → used directly with H1 APINo format specification needed — detect and proceed.
Searches HackerOne's public hacktivity and disclosed reports for similar findings. This is the external duplicate check — Layer 6 of the dedup system.
Before executing this skill:
.greyhatcc/scope.json — verify target is in scope, note exclusions.greyhatcc/hunt-state.json — check active phase, resume contextfindings_log.md, tested.json, gadgets.json — avoid duplicating workInternal dedup (layers 1-5) catches YOUR duplicates. Hacktivity check catches OTHER RESEARCHERS' duplicates. If someone already reported the same bug 3 months ago and it was resolved, yours will be marked duplicate.
Use the dedicated HackerOne MCP tools for the most reliable dupe detection:
Use: mcp__plugin_greyhatcc_hackerone__h1_dupe_check
Arguments: { handle: "<PROGRAM_HANDLE>", vuln_type: "<FINDING_TYPE>", asset: "<ASSET>" }
Returns: Dupe risk assessment (HIGH/MEDIUM/LOW/CLEAR) based on live hacktivity matching.
Use: mcp__plugin_greyhatcc_hackerone__h1_hacktivity
Arguments: { handle: "<PROGRAM_HANDLE>", page_size: 100 }
Returns: All recent activities. Manually scan for matching:
If HackerOne API is not configured or returns errors, fall through to Method 1 (Web Search).
Search for disclosed reports matching the finding:
WebSearch: site:hackerone.com/reports "<vulnerability_type>" "<target_domain>"
WebSearch: site:hackerone.com "<program_name>" "<vulnerability_type>"
WebSearch: "<program_name>" bug bounty "<vulnerability_type>" disclosed
Parse results for:
If the program has public hacktivity:
https://hackerone.com/<program>/hacktivityIf hacktivity is not public, Method 1 is the fallback.
Use Perplexity to search across:
perplexity_ask: "Has anyone reported <vulnerability_type> on <target_domain> on HackerOne or Bugcrowd? Look for disclosed bug bounty reports."
After collecting search results, match against these patterns:
## Hacktivity Check: <finding_description>
### Program: <program_name>
### Disclosed Reports Found: <N>
| # | Report | Severity | Asset | Date | Similarity |
|---|--------|----------|-------|------|------------|
| 1 | "CORS misconfiguration on api.example.com" | Medium | api.example.com | 2025-11-15 | HIGH (same vuln + same endpoint) |
| 2 | "Reflected XSS via search parameter" | Low | www.example.com | 2025-09-01 | LOW (different vuln type) |
### Dupe Risk Assessment: [HIGH / MEDIUM / LOW / CLEAR]
### Recommendation: [SUBMIT / DO NOT SUBMIT / DIFFERENTIATE]
- SUBMIT: No similar disclosed reports found, or finding is clearly different
- DO NOT SUBMIT: High-confidence duplicate exists in hacktivity
- DIFFERENTIATE: Similar report exists but your finding has unique aspects — clearly articulate the difference in your report title and description
### If DIFFERENTIATE:
Suggested differentiators:
- Different endpoint/asset: "Your finding is on api-au.syfe.com, disclosed report was on api.syfe.com"
- Different impact: "Your finding demonstrates data exfiltration, disclosed report was CORS without proof"
- Chain component: "Your finding chains with F-003 to achieve ATO, disclosed report was standalone"
For each finding, generate multiple search queries covering different angles:
Query templates:
1. Exact: "<program_name>" "<exact_vuln_type>" "<exact_endpoint>"
2. Broad: "<program_name>" "<vuln_category>" site:hackerone.com
3. Tech: "<program_name>" "<technology>" vulnerability disclosed
4. Endpoint: "<program_name>" "<endpoint_path>" security
5. CWE: "<program_name>" "CWE-<number>" disclosed
Map the finding to multiple search terms:
| Finding Type | Search Keywords |
|---|---|
| CORS misconfiguration | "CORS", "cross-origin", "Access-Control", "origin reflection" |
| IDOR | "IDOR", "insecure direct object", "broken access control", "unauthorized access" |
| XSS | "XSS", "cross-site scripting", "script injection", "reflected", "stored" |
| SSRF | "SSRF", "server-side request", "internal access", "metadata" |
| SQL injection | "SQL injection", "SQLi", "database", "query injection" |
| JWT manipulation | "JWT", "token", "algorithm confusion", "none algorithm" |
| OAuth bypass | "OAuth", "redirect_uri", "token theft", "authorization bypass" |
| Subdomain takeover | "subdomain takeover", "dangling CNAME", "unclaimed", "takeover" |
| GraphQL | "GraphQL", "introspection", "batching", "query abuse" |
| Actuator exposure | "actuator", "Spring Boot", "health endpoint", "env exposure" |
After collecting search results, filter out false positives:
| False Positive Signal | Action |
|---|---|
| Different program, same vuln type | Ignore — not a dupe for YOUR program |
| Same program, different asset entirely | Likely not a dupe — different asset |
| Same program, same vuln, but 2+ years old | Low dupe risk — likely different root cause |
| Blog post discussing the vuln type generically | Ignore — not a program-specific disclosure |
| Report marked "Informational" or "N/A" | Note — your report may face same fate |
| Report marked "Duplicate" with original visible | Check original — YOUR finding may also be a dupe of that original |
| Report resolved but fix confirmed incomplete | Your finding may be a VARIANT — clearly differentiate in report |
Use the dedicated HackerOne MCP server:
Use: mcp__plugin_greyhatcc_hackerone__h1_dupe_check
Arguments: { handle: "<program_handle>", vuln_type: "<vulnerability_type>", asset: "<target_asset>" }
This provides structured dupe risk assessment that is more reliable than scraping.
For deeper analysis:
Use: mcp__plugin_greyhatcc_hackerone__h1_hacktivity
Arguments: { handle: "<program_handle>", page_size: 100 }
Then search the returned activities for:
/greyhatcc:dedup as Layer 6osint-researcher-low (haiku)When delegating to agents via Task(), ALWAYS:
After completing this skill:
tested.json — record what was tested (asset + vuln class)gadgets.json — add any informational findings with provides/requires tags for chainingfindings_log.md — log any confirmed findings with severity